Empirically, we evaluate our MultiGuard on VOC 2007, MS-COCO, and NUS-WIDE benchmark datasets. We use the certified top-\(k\)  precision@\(R\), certified top-\(k\)  recall@\(R\), and certified top-\(k\)  f1-score@\(R\) to evaluate our MultiGuard. Roughly speaking, certified top-\(k\)  precision@\(R\)  is the least fraction of the \(k\)  predicted labels that are ground truth labels of an input when the \(\ell _2\) -norm of the adversarial perturbation is at most \(R\) ; certified top-\(k\)  recall@\(R\)  is the least fraction of ground truth labels of an input that are in the set of \(k\)  labels predicted by our MultiGuard; and certified top-\(k\)  f1-score@\(R\)  is the harmonic mean of certified top-\(k\)  precision@\(R\)  and certified top-\(k\)  recall@\(R\) . Our experimental results show that our MultiGuard outperforms the state-of-the-art certified defense [1]} when extending it to multi-label classification. For instance, on VOC 2007 dataset, Jia et al. [1]} and our MultiGuard respectively achieve 24.3% and 31.3% certified top-\(k\)  precision@\(R\) , 51.6% and 66.4% certified top-\(k\)  recall@\(R\) , as well as 33.0% and 42.6% certified top-\(k\)  f1-score@\(R\)  when \(k^{\prime }=1\) , \(k=3\) , and \(R=0.5\) .
